Researchers found that more than 543,000 credentials exposed in public GitHub repositories were still valid, leaving cloud accounts, databases, and developer services at risk of unauthorized access. Truffle Security says the finding came from scanning 224 million repositories and more than 58 billion files in a large GitHub dataset, with a median public exposure time of 784 days. About 199,843 of the live credentials were exposed after GitHub enabled Push Protection by default, and 51.8% were in categories that default blocking does not cover, including database connection strings and Google API keys.
Why it matters: This matters because long-exposed, still-working secrets can let attackers quietly access cloud services, source code pipelines, and data long after the original leak. Organizations should scan repositories and commit history, revoke and rotate exposed secrets immediately, and review whether GitHub secret-scanning coverage matches the credential types they use.
Bill Toulas
2026.09.30
100% relevant
This article establishes a distinct story about the scale and persistence of valid credentials exposed on GitHub, rather than a single-company breach or a specific CVE.
← Back to all stories